Hands-On Tech 284 Transcript
Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.
Mikah Sargent [00:00:00]:
Coming up on Hands-On Tech, let's answer the question of if deleted files are actually deleted. Stay tuned. Hello and welcome to Hands-On Tech. I am Mikah Sargent, and today we are taking a look at your tech questions and answering them. Can you believe it? Today's tech question comes from Harriet, who's writing in from Fresno, and Harriet has asked this question. Harriet says, Mikah, I emptied my recycle bin and then read an article saying the files are still on the drive and can be recovered. So which is it? When I delete something, where does it go? And the flip side, if a file I deleted by accident is still there somewhere, I get it back? I feel like I'm missing something fundamental about how this works.
Mikah Sargent [00:00:56]:
Harriet from Fresno, California. Harriet, thank you so much for taking the time to write in. Uh, as I've mentioned, I'm kind of settling in now on a bit of a template. So we start with the short answer, and the short answer for you, Harriet, is this: you and whatever article it was you read, well, you're actually both right. And Well, right, for different reasons, and also in different decades, if you can believe it. Because on old-style hard drives, deleted files will linger, but on the SSDs, the solid-state drives we have in modern machines, deletion is now genuine— genuinely deletion, and it happens pretty quick. So let's talk about it. First and foremost, what does delete actually do? Well, you know I love an analogy, and so I've got one for you.
Mikah Sargent [00:01:48]:
Let's think of it like a library. Your drive is a library. The place where your files are stored, it's like a library. And the files that you have are like books on the shelves. And the file system, the thing that is sort of in charge of these books, that's the card catalog. And it says where each one of your files lives. Okay? So library, drive, books, files, means of finding books, file system. Deleting a file doesn't mean that you've walked in, you found a book, and like Amazon or some of the other companies working to train their AI systems, you have not shred and destroyed the book.
Mikah Sargent [00:02:43]:
No. It doesn't shred the book automatically. Instead, what it does is it takes the card from that card catalog and then marks that space on the shelf as available. Okay? So the book is still sitting there, but it's doing so until something new needs the shelf. Does that make sense? So you've got a book that you don't need anymore. So you walk over to the card catalog and there you go, oh, this spot's open. And then if you were to ever go to that spot and need to put a book there because it's open, because you checked the card catalog, you would take that book off of the shelf at that point and get rid of it and put the new book there. What's funny is that the recycling bin, it's not even that far.
Mikah Sargent [00:03:31]:
It's, it's sort of like a holding folder, right? The, the recycling bin, when you move something to the recycling bin or the trash, depending on what system you're on, it's actually just another folder that your system system consider— you and your system have both agreed is like, this is the place where things go until it's time for them to go away. Nothing is deleted from your library until you empty that recycling bin or that trash can. And that is why recovery software has worked for so long. That's why it worked, because recovery software Looks at the file system, the card catalog, and says, oh, you've marked these spots as available, but I bet those books are still there. And then it walks down to those shelves and it goes, oh yeah, those books are still there. If you're curious to hear and learn rather more about how this system works, uh, the folks at How-To Geek have a great guide that walks you through the pro— the understanding of why it's Very difficult to recover data from an SSD and why HDDs, hard disk drives, were a little bit different. That old school method, due to trying to make sure that there's time, uh, there, there's performance that takes place, that you are able to access the full performance of your drive and not have to wait for things. That's not so much of a requirement anymore.
Mikah Sargent [00:05:06]:
Modern drives have made that a little bit different. With modern drives, the idea that files linger forever— yeah, no. That article was written for spinning hard drives. Nearly every computer sold in the last decade has used an SSD, and SSDs play by different rules. SSDs, first and foremost, can't really overwrite data in place. So if there's data there, if there's a book there, they can't shove a new book in because there's a book there. There's, there's nothing to put there. Can't take that book in the moment and sort of put the other book over the top of it.
Mikah Sargent [00:05:49]:
It can't overwrite data in place. A block has to be erased. The book has to be taken off the shelf before you can put a new book on. So to keep the drive fast, The operating system sends this command. It's like a housekeeping command that it's called, it's called TRIM, capital T-R-I-M, the moment you delete. And that tells the SSD, hey, these blocks, these spots on the shelf are trash. Can you please go ahead and erase them? On Windows, TRIM will fire automatically when you empty the recycling bin. And once it runs, and once the drive's cleanup is finished, that data's gone.
Mikah Sargent [00:06:37]:
And it does so within minutes. And there's not software that can bring it back. So let's take a look at this guide from Rossman Repair Group that says, can you recover There we go. Can you recover data after TRIM? After TRIM, SSD recovery depends on whether garbage collection physically erased the NAND. If the erase ran, the charge that held your files is gone. If the erase never ran because the drive lost power, used a legacy USB bridge, sat in RAID, or suffered controller failure, Then it's possible that it's able to recover. So this is partially a bit of advertising for this company, but the bigger idea here is just the idea that, I mean, because this guide, it's very, very, very involved and it helps to kind of figure out what trim is actually doing and what you can expect. Trim will tell the SSD controller, so the sort of librarian, so to speak, to unmap deleted data.
Mikah Sargent [00:07:56]:
And then what it does is later on, a process comes along called garbage collection, and it erases those blocks that have sort of invalid or, or marked for deletion storage spaces. So once it's erased, It's gone. If that physical erasure was never completed, then you're okay. But if it was, you'll notice that at the top it said, uh, the charge that held your files is gone. And that is a very important aspect of modern SSDs because it is holding a charge to keep that memory in storage. And that's different from something like a hard disk drive, which is writing the storage to those spinning disks. So if it fires, you don't have access to those files anymore. So that fundamental thing that you felt you were missing, it's just that, well, file recovery is a process that used to work really well and doesn't work as well anymore, but companies still make money on offering file recovery services.
Mikah Sargent [00:09:22]:
So let's talk about kind of the playbook of accidental deletion. How do we keep this from, you know, from continuing to be an issue? First and foremost, every new file that If you think that you accidentally deleted a file, right? Then stop using that drive immediately because every new file you put onto that disk could be the one, could be the book that replaces your book on the shelf. So if you're trying to save something, stop the processes. Don't let anything be written to that disk. And then look in those easy win spots first, the low-hanging fruit. Check the recycling bin or the trash. Check your cloud-synced folders. OneDrive has it, Google Drive has it, Dropbox has it, iCloud has it.
Mikah Sargent [00:10:14]:
A lot of them will keep these files that are deleted for a period of about 30 days at least. And then of course you can check backup systems if you have them, like File History or Time Machine. If it is truly gone from all of those and it's on an internal SSD, you gotta be honest with yourself, frankly. Because odds are poor that once TRIM has run, your odds are poor that you're going to get your files back. That said, there are some places where recovery tools still work. Of course, traditional hard drives like we talked about, camera SD cards, USB flash drives or USB external drives, many of them end up not getting to the point where they pass that TRIM command. So in those instances, the old rules will still apply. And you can use tools like Disk Drill, a very well-known tool, to scan those external drives.
Mikah Sargent [00:11:22]:
Of course, if you use Disk Drill, pro tip, make sure that you install it on a different drive from the one that you're rescuing. But this might be the time where you go, okay, if I don't have to really worry about files, if I delete all of these files from the drive and I'm planning on getting rid of this device, right? I wanna give my computer away or I wanna sell my computer. You might be going, well, it's an SSD, so if I hit delete on all these files, it's gonna be fine, right? Careful. Selling or donating an old spinning hard drive, of course, means that emptying the bin is not secure erasure. You do need to do a proper wipe. There are multiple ways to go about that. We won't talk about it in today's episode. That wasn't the question.
Mikah Sargent [00:12:14]:
But there is a modern shortcut that kind of takes care of the issue for you. If you keep your drive encrypted— BitLocker or FileVault on macOS, then it really doesn't matter what's on the drive because it is just unreadable to any person. So deleting those files and deleting them the proper way used to be a big part of reformatting a drive. I remember what was the way I was going to reformat the drive. Was it to write zeros to the entirety of the hard drive to do a proper secure erase, or was it just a quick one that I would then, you know, write over with new, with new data? It's a little bit different these days, but encryption by default, which of course can happen a lot faster on modern drives, means that even if someone else were to get access to those files, they're not as big of an issue. So the bottom line, delete removes the catalog card, but it doesn't remove the book. That said, on modern SSDs, let's bring this around, there is a custodian that shreds the book minutes later. So the custodian is like waiting at the card catalog, sees you've marked that spot as available, and says, well, gotta clean this place up.
Mikah Sargent [00:13:39]:
Do do do do. Walks over, Gets rid of the book. If you are running into an issue where you've got an accidental deletion, stop using the drive. RAID the bin, cloud backups first, check all of those, and then know that really recovery tools are for hard drives, HDDs, and memory cards. They don't work so well on internal SSDs. Recovery? I'm sorry, don't let recovery be the plan. Backup is the plan. So I hope, Harriet, that you have a backup plan in place.
Mikah Sargent [00:14:23]:
Thank you so much for taking the time to write in with your questions. hot@twit.tv is how you get in touch with me, and I would love to hear your questions as well. I'll be back again next week with another episode of Hands-On Tech, but until then, it's time to say— Goodbye!
